IN THE CLAIMS 

Please amend the claims to read as follows: 
Listing of Claims 

1. (Currently Amended) A network monitoring system for monitoring a communication 
state on a network in which action explanation information for explaining a single action is 
divided into a plurality of packets, the network monitoring system comprising: 

a data acquisition section that acquires the a plurality of packets flown on the a network; 

a data analysis section that acquires the action explanation information from the plurality 
of packets acquired by the data acquisition section; 

a display-information generation section that generates information of each individual 
action occurring on the network on the basis of the action explanation information acquired by 
the data analysis section; and 

a display unit that displays the information generated by the display-information 
generation section, wherein: 

in response to a request by a user, the display-information generation section regenerates, 
for continuous play back, information of a sequence of individual actions that occurred on the 
network and cooperates with the display unit to display, during each play back, the regenerated 
information of each individual action of the sequence at the same time interval within the 
sequence as the action occurred , and 

action explanation information for explaining each individual action is acquired from a 
plurality of packets . 
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2. (Original) The network monitoring system according to claim 1, wherein the action 
explanation information is defined in advance. 

3. (Original) The network monitoring system according to claim 1, wherein the data 
analysis section identifies kinds of the packets acquired by the data acquisition section and 
acquires the action explanation information from the packets on the basis of the identified kinds 
of the packets. 

4. (Currently Amended) The network monitoring system according to claim 1, wherein 
the action explanation information includes: 

sending source computer information and destination computer information T included in 
a connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

and action information included in a command packet; and 

data included in a data packet . 

5. (Previously Presented) The network monitoring system according to claim 1, further 
comprising: 

an analysis data storage section that stores the action explanation information acquired by 
the data analysis section, wherein: 
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the display-information generation section regenerates the information of the sequence of 
individual actions that occurred on the network from the action explanation information stored 
by the analysis data storage section. 

6. (Previously Presented) The network monitoring system according to claim 5, wherein: 
the action explanation information stored by the analysis data storage section includes 

time information, which corresponds to the time at which the single action occurred; and 
the display-information generation section determines the time interval, within the 
sequence, that each individual action occurred using the time information stored by the analysis 
data storage section. 

7. (Previously Presented) The network monitoring system according to claim 5, wherein 
the display-information generation section continuously regenerates the sequence after each 
predetermined period, which period is accurate within 500 milliseconds. 

8. (Previously Presented) The network monitoring system according to claim 1, wherein 
the display-information generation section extracts and generates the information of each action 
occurring on the network in accordance with a display setting set by a user. 

9. (Currently Amended) A network monitoring method for monitoring a communication 
state on a network in which action explanation information for explaining a single action is 
divided into a plurality of packets, the method comprising: 
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acquiring the a plurality of packets flown on the a network; 

acquiring the action explanation information from the plurality of acquired packets; 

generating information of each individual action occurring on the network on the basis of 
the acquired action explanation information; 

regenerating for continuous play back, in response to a request by a user, information of a 
sequence of individual actions that occurred on the network; and 

displaying on a display unit, during each play back, the regenerated information of each 
individual action of the sequence at the same time interval within the sequence as the action 
occurred , wherein 

action explanation information for explaining each individual action is acquired from a 
plurality of packets . 

10. (Original) The network monitoring method according to claim 9, wherein the action 
explanation information is defined in advance. 

11. (Original) The network monitoring method according to claim 9, wherein in the 
acquisition of the action explanation information, kinds of the packets acquired by the packet 
acquisition are identified and the action explanation information is acquired from the packets on 
the basis of the identified kinds of the packets. 

12. (Currently Amended) The network monitoring method according to claim 9, wherein 
the action explanation information includes: 
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sending source computer information^ and destination computer information^ included in 
a connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

and action information included in a command packet; and 

data included in a data packet . 

13. (Previously Presented) The network monitoring method according to claim 9, further 
comprising: 

storing the acquired action explanation information, wherein: 
the information of the sequence of individual actions that occurred on the network is 
regenerated from the stored action explanation information. 

14. (Previously Presented) The network monitoring method according to claim 13, 
wherein: 

the stored action explanation information includes time information, which corresponds 
to the time at which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 
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15. (Previously Presented) The network monitoring method according to claim 13, 
further comprising continuously regenerating the sequence after each predetermined period, 
which period is accurate within 500 milliseconds. 



16. (Previously Presented) The network monitoring method according to claim 9, 
wherein the information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 



17. (Currently Amended) A network monitoring program recorded on a computer 
readable medium and executable by a computer for the purpose of monitoring a communication 
state on a network in which action explanation information for explaining a single action is 
divided into a plurality of packets , the program making the computer perform a process 
comprising: 

acquiring the a plurality of packets flown on the a network; 

acquiring the action explanation information from the plurality of acquired packets; 

generating information of each individual action occurring on the network on the basis of 
the acquired action explanation information; 

regenerating for continuous play back, in response to a request by a user, information of a 
sequence of individual actions that occurred on the network; and 

displaying on a display unit, during each play back, the regenerated information of each 
individual action of the sequence at the same time interval within the sequence as the action 
occurred , wherein 



action explanation information for explaining each individual action is acquired from a 



plurality of packets . 



18. (Original) The network monitoring program according to claim 17, wherein the 
action explanation information is defined in advance. 

19. (Original) The network monitoring program according to claim 17, wherein in the 
acquisition of the action explanation information, kinds of the packets acquired by the packet 
acquisition are identified and the action explanation information is acquired from the packets on 
the basis of the identified kinds of the packets. 

20. (Currently Amended) The network monitoring program according to claim 17, 
wherein the action explanation information includes: 

sending source computer information^ and destination computer information T included in 
a connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

and action information included in a command packet; and 

data included in a data packet . 

21. (Previously Presented) The network monitoring program according to claim 17, 
wherein: 
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the process further comprises storing the acquired action explanation information; and 
the information of the sequence of individual actions that occurred on the network is 
regenerated from the stored action explanation information. 

22. (Previously Presented) The network monitoring program according to claim 21, 
wherein: 

the stored action explanation information includes time information, which corresponds 
to the time at which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 

23. (Previously Presented) The network monitoring program according to claim 21, 
wherein the process further comprises continuously regenerating the sequence after each 
predetermined period, which period is accurate within 500 milliseconds. 

24. (Previously Presented) The network monitoring program according to claim 17, 
wherein the information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 
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